---
id: "CVE-2026-79891"
kind: "vulnerability"
aliases: ["CVE-2026-79891"]
title: "AOS-8 CLI buffer overflow lets unauthenticated remote attackers run host commands"
severity: "high"
cvss: 8.1
epss: 0.00255
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "ArubaOS AOS-8 (8.13.x)", "fixed": ["8.13.3.1"], "affected": "<= 8.13.3.0", "ecosystem": "vendor"}, {"name": "ArubaOS AOS-8 (8.10.x)", "fixed": ["8.10.0.24"], "affected": "<= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aos-8", "aruba", "hpe", "infrastructure", "mobility-controller", "network-infrastructure", "wireless"]
not_affected_if: ["aos-10-only", "management-interface-restricted"]
published_at: "2026-10-22T19:18:01+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:18:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79891", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79891", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:18:40+00:00"}]
---

# AOS-8 CLI buffer overflow lets unauthenticated remote attackers run host commands

Buffer overflow in the AOS-8 CLI lets an unauthenticated remote attacker run commands as a privileged user on the host if preconditions outside their control are met (CVSS 8.1, AC:H). Part of HPE bulletin HPESBNW05162 (72 CVEs). No known exploitation or public PoC as of 2026-10-22; fixed in 8.13.3.1 and 8.10.0.24.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ArubaOS AOS-8 (8.13.x) affected <= 8.13.3.0 fixed 8.13.3.1
- vendor:ArubaOS AOS-8 (8.10.x) affected <= 8.10.0.23 fixed 8.10.0.24

## How to check

On each Mobility Conductor, Controller, Gateway or Instant AP, run 'show version' and compare with: affected if 8.13.x at or below 8.13.3.0, or 8.10.x at or below 8.10.0.23. Branches 8.12 and earlier are EoM/EoS and should be treated as potentially affected. Also check whether CLI (SSH/telnet) and management interfaces are reachable from untrusted networks.

## Fix

Upgrade AOS-8 to 8.13.3.1 (8.13 branch) or 8.10.0.24 (8.10 branch) or later; download from networkingsupport.hpe.com. Interim: restrict CLI and web management interfaces to a dedicated layer 2 VLAN and/or firewall policy.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79891
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79891
- 2026-10-25T03:18:40+00:00 analyst — Read HPE bulletin HPESBNW05162 (signed text, 2026-Oct-22): AOS-8 8.13.x<=8.13.3.0 and 8.10.x<=8.10.0.23 affected; fixed 8.13.3.1 / 8.10.0.24. HPE says no known public discussion or exploit; CISA SSVC exploitation none. Per-CVE details section was truncated in my read, so the exact preconditions are unknown (HPE only says 'outside attacker's control', AC:H). Not marked verified: how_to_check, who_affected.

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [describes] CVE-2026-79891 CVE record (CNA hpe) https://db.gcve.eu/vuln/cve-2026-79891

## From the sources

A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_